- Tell my users not to trust emails asking for passwords, etc
That is a good move. You could reinforce this message by never sending any sort of email containing links. The only difficulty is that many email clients will automatically convert strings that look like web addresses to clickable links. You could reiterate that users should type the address in their browser to access your site and should not click the link.
- Buy all domains similar to mine (expensive and difficult)
Is there really nothing else I can do?
The Wikipedia article contains a section on Defending against the attack. These are all browser based. You could encourage users to only use browsers that protect against IDNs. For example, Chrome's approach is:
Google Chrome displays an IDN only if all of its characters belong to one (and only one) of the user's preferred languages.
Two factor authentication can protect against the risk of an attacker successfully phishing a username and password and then using those to log in herself. However, if the user thinks they have successfully authenticated with your site then this does nothing to mitigate the risk of the user divulging further details in their logged in session with the attacker's site. Also, an attacker could get their phishing site to ask for the second factor of authentication and simply enter those into the original site when the user enters those on the phishing site (providing the attacker is phishing in real time rather than checking their server logs at a later time).
Asking for only certain letters from the password is also easily circumvented. Phishing sites usually will just say that the two letters entered were incorrect and then ask for another two until the full password is discovered. Also this means that you cannot save the password hashed, and password managers usually have trouble filling dynamic fields like these.
Another solution to mitigate phishing in general is to encourage the usage of browser based password managers. These check that the URL matches the one stored in the password manager so it will not complete the password if there are any homograph attacks in progress.